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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1)13 Responsive to communication(s) filed on 28 November 2005 . 
2a)D This action is FINAL. 2b)M This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G. 21 3. 

Disposition of Claims 

4) H3 Claim(s) 1-4,6-12, 14-20 and 22-24 is/are pending in the application. 
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5) D Claim(s) is/are allowed. 

6) g] Claim(s) 1-4.6-12.14-20 and 22-24 is/are rejected. 
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8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) [3 The drawing(s) filed on 31 July 2002 is/are: a)S accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
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1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 
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application from the International Bureau (PCT Rule 17.2(a)). 
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1 This action is in response to the communication filed on 1 1/28/2005. 

2 DETAILED ACTION 

3 Continued Examination Under 3 7 CFR LI 14 
4 

5 A request for continued examination under 37 CFR 1.114, including the fee set forth in 



6 37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 

7 eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 

8 has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 

9 37 CFR 1.114. Applicant's submission filed on 1 1/28/2005 has been entered. 



1 0 Response to Arguments 

1 1 Applicant's arguments filed 1 1/28/2005 have been fully considered but they are not 

12 persuasive. Applicants argue primarily that: 

13 a. Marsh did not disclose limitations (ii) or (iii). 

14 b. Marsh would be useless if the malware attempted to disguise itself. 

15 Regarding applicants' argument a., the examiner does not find the argument persuasive. 

16 Applicant argues that Marsh does not contain (ii), or (iii). The examiner notes that this argument 

17 does not make sense because the examiner has made no claim that Marsh contains the limitations 

18 (ii) or (iii). The examiner reiterates that Marsh has (i) and therefore the examiner does not find 

19 the argument persuasive. 

20 Regarding applicants' argument b, that Marsh would be useless if the malware attempted 

21 to disguise itself, the examiner does not find the argument persuasive. Again the examiner 

22 points out that this argument does not make sense as how Marsh would perform against a 
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1 disguised virus has nothing to do with weather Marsh meets the limitations of the claim 

2 language. Therefore, the examiner does not find the argument persuasive. 

3 Claims 1-4, 6-12, 14-20, and 22-24 have been examined. Claims 5, 13, and 21 have been 

4 cancelled. 

5 All objections and rejections not presented below have been withdrawn. 

6 Claim Rejections - 35 USC § 1 02 

1 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 

8 basis for the rejections under this section made in this Office action: 

9 A person shall be entitled to a patent unless - 

10 (e) the invention was described in (1) an application for patent, published under section 

1 1 122(b), by another filed in the United States before the invention by the applicant for 

1 2 patent or (2) a patent granted on an application for patent by another filed in the United 

13 States before the invention by the applicant for patent, except that an international 

14 application filed under the treaty defined in section 351(a) shall have the effects for 

1 5 purposes of this subsection of an application filed in the United States only if the 

1 6 international application designated the United States and was published under Article 

1 7 21(2) of such treaty in the English language. 
18 

19 Claims 1-3, 5, 7, 9-11, 13, 15, 17-19, 21, and 23 are rejected under 35 U.S.C. 102(e) as 

20 being anticipated by Marsh (US Patent Number 6.763,462). 

21 Regarding claims 1, 9, and 17, Marsh disclosed a method, apparatus, and program (See 

22 Marsh Claims) operable to control an e-mail client computer to detect e-mail propagated 

23 malware (See Marsh Abstract), comprising: e-mail generating logic operable to generate an e- 

24 mail message (See Marsh Col. 2 Lines 1 1-25); comparison logic operable to compare said e-mail 

25 message with at least one of an address book of a sender of said e-mail message (See Marsh Col. 

26 1 Lines 61-64 and Col. 2 Lines 44-46) and one or more previously generated e-mail messages 
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1 from said client computer (See Marsh Col. 3 Lines 62-65); and identifying logic operable to 

2 identify said e-mail message as potentially containing malware if at least one of: (i) said e-mail 

3 message is being sent to more than a threshold number of addressees specified within said 

4 address book (See Marsh Col. 1 Lines 61-64 and Col. 2 Lines 44-46, and Col. 3 Lines 13-34); 

5 (ii) said e-mail message contains message content having at least a threshold level of similarity 

6 to non-identical message content of said previously generated e-mail messages being sent to 

7 more than a threshold number of addressees specified within said address book; and (iii) said e- 

8 mail message contains message content having at least a threshold level of similarity to non- 

9 identical message content of more than a threshold number of said previously generated e-mail 

10 messages; and quarantine queue logic operable to hold said previously generated e-mail 

1 1 messages in a quarantine queue for at least a predetermined quarantine period prior to being sent 

12 from said client computer (See Marsh Col. 3 paragraphs 2-4 wherein Marsh disclosed comparing 

13 outgoing messages for a certain period of time, two minutes, and if the threshold was reached 

14 during that time, the message was deleted and not sent, which implied that the message was held 

1 5 for the specified period of time before being sent). 

16 Regarding claims 2, 10, and 18, Marsh disclosed that wherein said e-mail message 

17 specifies a plurality of addressees, said comparison logic being operable to compare said 

18 plurality of addressees with said e-mail address book to determine if said at least a threshold 

19 number of addressees has been exceeded (See Marsh Col. 2 Lines 39-46 and Col. 3 Lines 15-34). 

20 Regarding claims 3,11, and 19, Marsh disclosed that said at least a threshold number of 

21 addressees is specified as a proportion of addressees within said address book (See Marsh Col. 2 

22 Lines 58-61). 
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1 Regarding claims 7, 15, and 23, Marsh disclosed confirmation input logic operable when 

2 said e-mail message is identified as potentially containing malware to generate a user message 

3 seeking a confirmation input from a user of said client computer before said e-mail message is 

4 sent (See Marsh Col. 3 Lines 35-43). 

5 Claim Rejections - 35 USC §103 

6 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

7 obviousness rejections set forth in this Office action: 

8 (a) A patent may not be obtained though the invention is not identically disclosed or 

9 described as set forth in section 102 of this title, if the differences between the subject 

1 0 matter sought to be patented and the prior art are such that the subject matter as a whole 

1 1 would have been obvious at the time the invention was made to a person having ordinary 

1 2 skill in the art to which said subject matter pertains. Patentability shall not be negatived 

1 3 by the manner in which the invention was made. 
14 

15 Claims 4, 6, 12, 14, 20, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 

16 over Marsh as applied to claims 1, 9, and 17 above, and further in view of Bates et al. (US Patent 

17 Number 6,785,732) hereinafter referred to as Bates. 

18 Marsh disclosed both a proportion of addresses (See rejection of claim 3 above) and a 

19 specified time period (See rejection of claim 7 above) but failed to disclose the proportion and 

20 the time period could be user specified. 

21 Bates teaches that in a virus checker, a users can specify preferences about the virus 

22 checking (See Bates Col. 8 Lines 49). 

23 It would have been obvious to the ordinary person skilled in the art at the time of 

24 invention to employ the teachings of Bates in the virus detector of Marsh by allowing the user to 

25 specify the proportion and the time period used for determining a threat. This would have been 
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1 obvious because the ordinary person skilled in the art would have been motivated to allow the 

2 user of the virus checker to specify how the checker would operate. 

3 Claims 8, 16, and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

4 Marsh as applied to claims 1, 9, and 17 above, and further in view of Kouznetsov (US Patent 

5 Number 6,725,377). 

6 Marsh disclosed sending alert an alert to a user upon detection of possible virus activity 

7 (See Col. 3 Lines 18-22), but failed to disclose sending an alert to an administrator upon 

8 detection of possible virus activity. 

9 Kouznetsov teaches that in computer intrusion detection systems, when attack 

10 characteristics are detected, it is typical to notify an administrator of the detection (See 

1 1 Kouznetsov Col. 1 Paragraph 6). 

12 It would have been obvious to the ordinary person skilled in the art at the time of 

13 invention to employ the teachings of Kouznetsov in the virus detection system of Marsh by 

14 alerting an administrator of detected possible virus activity. This would have been obvious 

15 because the ordinary person skilled in the art would have been motivated to provide the 

16 administrator with the knowledge of the possible attack in order for the administrator to take 

17 appropriate action. 

1 8 Conclusion 

19 Claims 1-4, 6-12, 14-20, and 22-24 have been rejected. 

20 Any inquiry concerning this communication or earlier communications from the 

21 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

22 The examiner can normally be reached on M-F 8-4. 



Art Unit: 2131 

1 If attempts to reach the examiner by telephone are unsuccessful, the examiner's 

2 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

3 organization where this application or proceeding is assigned is 571-273-8300. 

4 Information regarding the status of an application may be obtained from the Patent 

5 Application Information Retrieval (PAIR) system. Status information for published applications 

6 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

7 applications is available through Private PAIR only. For more information about the PAIR 

8 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

9 system, contact the Electronic Business Center (EBC) at 866-21 7-91 97 (toll-free). 
10 

11 
12 

14 /^^^Z-^^ ' AYAZ SHEIKH 

^^y^^— SUPERVISORY PATENT EXAMINER 

1 5 Matthew Henning TECHNOLOGY CENTER 21 00 

1 6 Assistant Examiner 

17 Art Unit 2131 

18 2/9/2006 



